AI chatbots must get your permission to train on your conversations

What it does

This bill requires AI chatbot providers to obtain explicit user consent before using chat data for training or advertising, prohibits selling chat logs, mandates monthly safety assessments for minors, requires clear disclosure that users are talking to AI (not humans), and gives users rights to access and delete their data. It creates federal enforcement through the FTC and private lawsuits, with statutory damages up to $250,000 for violations causing serious harm.

Why we flagged it

The bill's core mechanism is a comprehensive privacy and safety regime for AI chatbots, restricting data use, requiring consent, mandating transparency, and creating enforcement. It is functionally a consumer protection statute, not a deregulation or subsidy.

What the text implies

• Statutory damages of $250,000 per violation for harm-causing violations may create significant litigation risk for chatbot providers, potentially chilling innovation or leading to defensive business model changes (e.g., refusing US users).
• The definition of 'covered harm' (death, suicide attempt, psychiatric emergency) creates liability even when a provider exercised reasonable care, shifting injury risk entirely to the provider regardless of causation clarity.
• Monthly risk assessments and quarterly public disclosures of safety metrics may reveal competitive vulnerabilities or training methodologies, creating pressure to disclose proprietary information.
• The requirement to disable harmful features for minors 'known or should know' to be under 18 creates an affirmative duty to age-gate or restrict service, potentially excluding minors from beneficial uses.
• Private right of action with 2-year discovery rule and attorney's fees may incentivize class actions and individual suits, creating ongoing litigation exposure for providers.

Section numbers refer to the bill text the analysis read — linked under Primary records below.

Who it affects

Ordinary users gain enforceable privacy rights, data portability, deletion rights, and protection from manipulative design targeting minors. Providers are restricted from profiting off user conversations without consent and from using dark patterns to extract data. The private right of action with statutory damages creates real enforcement teeth.

Who stands to gain

• plaintiff's attorneys (private right of action with attorney's fees)
• consumer advocacy organizations (enforcement standing)
• compliance and privacy consulting firms

Named in the bill

Federal Trade Commission (FTC), AI chatbot providers (unnamed), State attorneys general, Users (individuals of all ages)

Where it stands

3 cosponsors: 3 Democrats.

• Jul 9, 2026 — Introduced · Congress.gov: “Introduced in House”
• Jul 9, 2026 — Referred to House Committee on Energy and Commerce · Congress.gov: “Referred to the House Committee on Energy and Commerce”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.